[SPARK-32495] Update jackson-databind versions to fix various vulnerabilities.

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.4.6
• Component/s: Spark Core
• Assignee: Unassigned
• Reporter: SHOBHIT SHUKLA
• Created: 30/Jul/20 10:39
• Updated: 31/Aug/20 06:11
• Resolved: 31/Aug/20 06:11

Description

As a vulnerability for Fasterxml Jackson version 2.6.7.3 is affected by CVE-2017-15095 and CVE-2018-5968 CVEs https://nvd.nist.gov/vuln/detail/CVE-2018-5968, Would it be possible to upgrade the jackson version for spark-2.4.6 and so on(2.4.x).

Issue Links

• links to: [Github] Pull Request #29334 (ScrapCodes)